Decision guides
A decision guide takes one choice a developer actually faces, lists the options and the criteria, and fills in a comparison where every claim says how we know it: stated in a specification, seen in an experiment we ran, or reasoned by us. Each guide recommends by scenario, not with a single winner, and lists what would change the advice.
The guides so far cover how an HTTP API recognizes its callers, which permission setup fits a coding agent task, and how to keep an agent away from a file. They are independent; read the one that matches your choice.
Reading order
How should an API authenticate and authorize requests?
How an API recognizes its callers: sessions, opaque tokens, JWT access tokens and API keys compared on revocation, per-request cost, leaks and caller type.
Claude Code or Codex: which permission setup fits the task?
Which permission setup fits a coding agent task, with the same four steps run through two tools.
How to keep an AI coding agent away from a file
How to keep an agent away from a file: an instruction, a deny rule and a hook compared, with the route that got around each.
What we have not covered yet
- Choices that depend on a particular product's pricing or on your organization's policy.
- Benchmarks or rankings of tools; the guides compare setups on stated criteria and avoid scores.